Location: Distributed
About Us
At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world’s largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company.
At Cloudflare, we’re not looking for people who wait for a polished roadmap; we’re looking for the builders who see the cracks in the Internet that everyone else has simply learned to live with. We value candidates who have the instinct to spot a "normalized" problem and the AI-native curiosity to create a solution using the latest tools. Our culture is built on iteration, leveraging AI to ship faster today to make it better tomorrow, while ensuring that every improvement, no matter how small, is shared across the team to lift everyone up. If you’re the type of person who values curiosity over bureaucracy, and that AI is a partner in solving tough problems to keep the Internet moving forward, you’ll fit right in.
Available Locations
Germany
Responsibilities
The Customer Engineer (CE) is the core driver of our technical go-to-market strategy: a trusted technical advisor and primary architect of the customer journey. You will bridge the gap between technical strategy and business value. You'll guide startup and AI customers from the first conversation about their AI ambitions through technical validation, production deployment, and long-term adoption and expansion. Sitting within the GTM organization and reporting to a Customer Engineering Leader, you will not hand off your customers once an initial agreement is reached. Instead, you will operate as a quota-carrying technologist, leveraging AI-augmented workflows to eliminate administrative toil so you can focus on high-value architectural design and driving measurable business outcomes across the Startup AI segment.
Technical Discovery & Validation:
Partner closely with Account Executives to lead technical deep-dive discovery and uncover what kind of AI problem a customer actually has. It might be building AI products and agents, governing how their people and agents use AI, or protecting internet-facing applications from AI-driven threats and traffic. Turn that into a sequenced plan rather than a feature tour. Capture business requirements and map startup and AI customer infrastructure (DNS, CDN, Zero Trust, Network Security, serverless and edge compute) to fit-for-purpose Cloudflare architectures and bespoke solutions. Define scope, success criteria, and technical evaluation plans for Proofs of Concept (PoCs) and Technical Validations, anchored in measurable quality, latency, and cost targets rather than subjective impressions. Rapidly build working, customer-specific prototypes. Deliver tailored technical presentations, architectural diagrams, and demonstrations that show how Cloudflare solves specific performance, security, reliability, and scale challenges. Proactively address complex technical objections, security compliance questions, and edge-case architectural requirements during the sales cycle. Take accountability for a suitable solution deployment strategy (Customer, Partner or Cloudflare Professional Services) being an integral part of all proposals.
Customer Adoption & Value Realization:
Oversee technical onboarding and implementation without executing it yourself, serving as the primary executive and engineering contact for the customer. Design structured migration and onboarding blueprints tailored to the customer's environment (e.g. DNS migrations, Zero Trust rollouts, WAF tuning guidance). Act as the lead consultant for customer engineering teams, walking them step-by-step through configuration best practices. Guide customers in taking AI applications and agents from prototype to production in a way that is reliable, safe, and affordable. That covers durable state and failure recovery for long-running agents; secure agent design such as defenses against prompt injection, scoped access, and human approval for sensitive actions; and the right model choices for each task. After go-live, help customers keep AI workloads healthy through tracing, quality and cost monitoring, and safe rollout of model and prompt changes, feeding production learnings back into evaluation. Partner with Account Executives to own discovery, demos, onboarding, technical health, risk, and expansion strategy. Proactively monitor customer health scores and telemetry to ensure rapid time-to-value, resolve integration bottlenecks, and reduce deployment risk as customers move from early-stage development to production scale.
Commercial Accountability & Expansion:
Carry a variable quota tied directly to new business acquisition and/or ongoing account growth. Be commercially accountable for ensuring deep platform adoption, retaining revenue, and identifying strategic cross-sell and up-sell opportunities based on product usage data and the evolving needs of startup and AI customers. Translate AI spend into clear business cases, such as cost per task or per resolved request. Lead technical Quarterly Business Reviews (QBRs) to translate platform capabilities into return on investment for founders, C-level executives, and engineering leaders.
Ecosystem & Business Development:
Help build and grow Cloudflare's presence in the startup and AI ecosystem. Develop relationships with incubators, accelerators, venture capital firms, founder communities, and developer meetups to generate new pipeline alongside Account Executives. Represent Cloudflare at startup events, demo days, and hackathons, and identify high-potential AI startups early in their journey.
Trusted Advisory:
Act as a trusted technical advisor throughout the entire customer lifecycle, maintaining a continuous, deep relationship with founders, CTOs, engineering leaders, and other key stakeholders from initial onboarding through maturity, renewal, and expansion. Provide thought partnership on architecture, agent design, AI governance and compliance (e.g. GDPR, EU AI Act, data residency), security posture, and deployment confidence. Identify potential deployment risks or integration bottlenecks early, and provide remediation strategies to de-risk customer outcomes.
AI Orchestration & Workflow Automation:
Use AI agents, coding agents, Large Language Models (LLMs), and internal platforms as a default way of working. Automate routine tasks such as meeting preparation, RFP/Security Questionnaire responses, sandbox provisioning, demo setup, basic telemetry monitoring, and internal/external documentation, so you have more time for strategic customer advisory. Apply AI-assisted workflows to support customer engineering teams and improve the speed and quality of technical validation. Share hands-on learnings and gaps with product teams as a direct feedback channel.
Education & Enablement:
Partner closely with the Enablement Team to design, build, and govern technical resources. Define, document, and educate both internal teams and customers on deliverables such as Standard Operating Procedures (SOPs), architectural best practices, and technical guides to continuously raise the technical baseline across the organization. Support technical enablement for startup and AI customers through workshops, code samples, documentation, and developer onboarding.
This role may require travel up to 20–50% to attend customer meetings, conferences, industry events, and in-person team collaboration.
Desirable Skills, Knowledge, and Experience
Experience:
Experience in a customer-facing technical role, such as Solutions Engineering, Customer Engineering, Professional Services, Sales Engineering, Technical Account Management, or as a Forward Deployed Engineer (years of experience required will vary based on Associate, Senior, Staff, or Principal leveling). Experience working with startups, AI companies, digital-native businesses, or as part of a startup engineering team is strongly valued.
Startup Ecosystem Network:
An established network within incubators, accelerators, venture capital, and the broader startup scene is highly desirable, along with the drive to take on business development activities and open doors to new relationships.
Architectural Mindset:
Ability to white-board, design, and articulate complex enterprise, startup, AI application, agent, network, and security architectures clearly.
Consultative & Advisory Skills:
Excellent communication skills with the ability to translate deeply technical concepts into business outcomes for both hands-on engineers and C-level executives, founders, and technical leaders.
Commercial Mindset:
Proven track record of operating in a quota-carrying or revenue-aligned environment, with a strong understanding of SaaS metrics, business value translation, and enterprise, mid-market, or startup sales cycles.
Communication:
Exceptional presentation and stakeholder management skills, capable of bridging the gap between deep technical implementation details and high-level C-suite business strategy. Business fluency in German is required.
Technical Breadth:
We do not expect every candidate to be an expert in every domain. Qualified candidates will demonstrate depth in at least four of the technical areas below:
Internet fundamentals:
Deep understanding of how the Internet works, including OSI Model layers 1–7, BGP, GRE, TCP/UDP, DNS (authoritative and recursive), HTTP(S), and SSL/TLS.
Security:
Expertise in the security of Internet properties, including WAF, Bot Management, Firewalls, Rate Limiting, (M)TLS, Zero Trust, and SASE concepts.
Performance:
Expertise in the performance of Internet properties, including speed, latency, caching, video streaming, HTTP/2, and TLS 1.3.
AI Engineering:
Solid grounding in AI model fundamentals (model size, context length, reasoning models, fine-tuning versus prompting, and matching the right model to the job). Familiarity with common agent patterns, including knowing when a simple workflow beats an agent, and with open agent frameworks and standards such as MCP. Understanding of how to evaluate and operate AI systems in production.
AI-Augmented Workflows:
Familiarity with prompt engineering, building prototypes with coding agents, AI-assisted scripting and log analysis, and workflow automation to augment everyday CE workflows.
Coding/Scripting:
Proficiency in Python, JavaScript, Bash, Lua, Go, or similar languages to write custom integration scripts, API connectors, and edge computing functions.
Developer Platform Fluency:
Experience designing, building, deploying or scaling applications using RESTful/GraphQL APIs, SDKs, webhooks, and developer tooling in cloud-native environments. Familiarity with infrastructure-as-code (Terraform, Pulumi), CI/CD pipelines, and observability for developer-led deployments.
Bonus Points
Technical Enablement:
Track record of creating and delivering technical enablement (workshops, code samples, documentation, or developer onboarding) that accelerates customer adoption of complex platforms.
Applied AI Knowledge:
Hands-on experience with retrieval and knowledge systems (RAG, embeddings, reranking, agentic search), domain adaptation through lightweight fine-tuning, sandboxed execution environments for agents that write and run code, LLM orchestration, or model-access controls.
AI Traffic & the Agentic Web:
Understanding of how AI crawlers and agents interact with internet-facing applications: protecting AI endpoints, managing bot and agent access, and exposing services to agents.
Regulatory Knowledge:
Understanding of regulatory requirements such as PCI DSS, HIPAA, SOC 2, GDPR, and the EU AI Act.
Hyperscaler / Digital Native / Startup Background:
Talent coming out of hyperscalers, digital natives, distributed systems environments, or startups is strongly valued for its deeper cloud fluency, advanced architecture depth, and ability to operate effectively in fast-moving, ambiguous environments.
Compensation
For Germany based hires: Estimated annual salary is between €116,000 - €182,000.
This role is eligible to earn incentive compensation under Cloudflare's Sales Compensation Plan. The estimated annual salary range includes the on-target incentive compensation that may be attained in this role under the Sales Compensation Plan.
Equity: This role is eligible to participate in Cloudflare's equity plan.
What Makes Cloudflare Special?
We’re not just a highly ambitious, large-scale technology company. We’re a highly ambitious, large-scale technology company with a soul. Fundamental to our mission to help build a better Internet is protecting the free and open Internet.
Project Galileo
: Since 2014, we've equipped more than 2,400 journalism and civil society organizations in 111 countries with powerful tools to defend themselves against attacks that would otherwise censor their work, technology already used by Cloudflare’s enterprise customers--at no cost.
Athenian Project
: In 2017, we created the Athenian Project to ensure that state and local governments have the highest level of protection and reliability for free, so that their constituents have access to election information and voter registration. Since the project, we've provided services to more than 425 local government election websites in 33 states.
1.1.1.1
: We released
1.1.1.1
to help fix the foundation of the Internet by building a faster, more secure and privacy-centric public DNS resolver. This is available publicly for everyone to use - it is the first consumer-focused service Cloudflare has ever released. Here’s the deal - we don’t store client IP addresses never, ever. We will continue to abide by our
privacy commitment
and ensure that no user data is sold to advertisers or used to target consumers.
Sound like something you’d like to be a part of? We’d love to hear from you!
Please note that applicants who progress to the offer stage of the interview process may be asked to attend an in-person interview within one of the Cloudflare Offices or Cloudflare Hubs. More details about this will be available at that stage of the interview process.
This position may require access to information protected under U.S. export control laws, including the U.S. Export Administration Regulations. Please note that any offer of employment may be conditioned on your authorization to receive software or technology controlled under these U.S. export laws without sponsorship for an export license.
Cloudflare is proud to be an equal opportunity employer. We are committed to providing equal employment opportunity for all people and place great value in both diversity and inclusiveness. All qualified applicants will be considered for employment without regard to their, or any other person's, perceived or actual
race, color, religion, sex, gender, gender identity, gender expression, sexual orientation, national origin, ancestry, citizenship, age, physical or mental disability, medical condition, family care status, or any other basis protected by law.
We are an AA/Veterans/Disabled Employer.
Cloudflare provides reasonable accommodations to qualified individuals with disabilities. Please tell us if you require a reasonable accommodation to apply for a job. Examples of reasonable accommodations include, but are not limited to, changing the application process, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment. If you require a reasonable accommodation to apply for a job, please contact us via e-mail at
hr@cloudflare.com
or via mail at 101 Townsend St. San Francisco, CA 94107.
Задачи:
— Администрировать, поддерживать и оптимизировать облачные платформы и инфраструктуру.
— Настраивать, конфигурировать, поддерживать и совершенствовать CI/CD- и GitOps-пайплайны.
— Внедрять и поддерживать практики Infrastructure as Code (IaC) с использованием таких инструментов, как Ansible, Terraform, Pulumi.
— Управлять контейнеризированными средами с использованием Docker, Docker Swarm и Kubernetes.
— Обеспечивать надежную инфраструктуру и процессы развертывания для BI-сервисов и приложений, включая ClickHouse, SQL, Airflow, Tableau, Superset.
— Тесно взаимодействовать с командами разработки и BI для повышения надежности развертывания, консистентности окружений и операционной эффективности.
Требования:
— Уверенные навыки настройки и администрирования как минимум одной облачной платформы.
— Уверенные навыки построения и автоматизации процессов развертывания с использованием CI/CD и GitOps.
— Опыт построения масштабируемой IT-инфраструктуры.
— Уверенные навыки настройки Linux-серверов и устранения неисправностей.
— Практический опыт работы с Kubernetes.
— Понимание сетевой модели OSI.
— Понимание принципов построения надежной и масштабируемой инфраструктуры, а также автоматизированных процессов развертывания.
— Знание принципов информационной безопасности и защиты данных.
— Интерес к работе с инфраструктурой для Business Intelligence и data-related решений либо соответствующий практический опыт.
Задачи:
— Настройка и поддержка инфраструктуры компании;
— Автоматизация процессов через написание скриптов (Bash, Python);
— Внедрение и обслуживание CI/CD (GitLab, ArgoCD);
— Работа с инструментами контейнеризации (Docker, Kubernetes);
— Настройка систем мониторинга и логирования PHP-приложений (Prometheus);
— Управление конфигурациями (Ansible, Terraform);
— Мониторинг и повышение производительности систем;
— Обеспечение безопасности и надежности инфраструктуры;
— Настройка и обслуживание сетевого оборудования (Cisco, MikroTik);
— Администрирование серверов на Linux Debian и Windows Server AD;
— Управление виртуализацией (KVM, Proxmox).
Условия:
— Возможность делать уникальные продукты, которых нет на рынке;
— Атмосфера неизбежного профессионального роста;
— Работа в молодом и позитивном коллективе;
— Гибридный формат работы в офисе м. Комсомольская/ м. Проспект Мира;
— Пятидневная рабочая неделя;
— Оформление по ТК РФ;
— ДМС.
ГибридmiddleМосква
Не хотите искать каждый день?
Настройте подбор один раз, и подходящие вакансии будут сами приходить в Telegram.
Настройте подбор, и подходящие вакансии будут приходить в Telegram.
Задачи:
— Обслуживание и обновление LMS: управление получением пакетов обновлений и их применение к системе LMS, загрузка контейнерных образов и их отправка во внутренний Docker регистр.
— Управление инфраструктурой: локальное развертывание и конфигурация инфраструктуры, выполнение развертывания и настройки кластеров Kubernetes, обслуживание базы данных на выделенном инстансе отдельно от кластера Kubernetes, установка и мониторинг автоматического резервного копирования БД с периодичностью каждые 24 часа.
— Хранилище и пайплайны развертывания: управление доступом к объектным хранилищам (AWS S3 или аналогичным), получение пакетов из назначенных источников и управление их загрузкой в объектное хранилище.
Требования:
— Облачные платформы и инфраструктура: AWS, GCP, Azure; экспертный опыт работы с Docker и Kubernetes (развертывание, конфигурация и оркестрация); уверенное владение подходом Infrastructure as Code (Terraform, Ansible).
— CI/CD и автоматизация: опыт проектирования и поддержки пайплайнов CI/CD (Jenkins, GitLab CI/CD).
— Программирование и скрипты: уверенное владение Python и Go (Golang); навыки написания скриптов на Bash/Shell для автоматизации.
— Мониторинг и Observability: опыт развертывания и управления инструментами мониторинга (Prometheus, Grafana, Zabbix, ELK Stack: ElasticSearch/Kibana).
— Операционные системы: глубокие знания операционных систем на базе Linux (NixOS, Ubuntu Core).
— Понимание микросервисной архитектуры и распределенных систем.
— Знание методологий Agile, стандартов ITIL и процессов управления инцидентами.
— Опыт работы с высоконагруженными средами и проведения аудита инфраструктуры.
Условия:
— Заработная плата обсуждается по результатам собеседования и зависит от навыков кандидата.
— Формат работы — офис (удалёнка не предусмотрена, специфика проекта).
— Москва, Зеленоград, Казань.
— Работа над технологически сложным продуктом на стыке Computer Vision и мобильной разработки.
— Возможности для профессионального роста и влияния на процессы.
Location: Remote Canada
At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most.
The InfoSec team protects Affirm’s systems and data from evolving threats. We manage security risk, monitor vulnerabilities, and enforce protective controls across the company. The team leads incident response, compliance, identity and access management, and employee training. Our goal is to ensure that security is built into every system and decision at Affirm. We maintain a secure, trustworthy environment so the business can operate and grow with confidence.
In this role, you'll build and run Affirm's end-to-end security review process for enterprise AI/LLM systems evaluating architecture, prioritizing AI-specific risks, and designing the controls and guardrails that let Affirm adopt AI safely, partnering across Security, Legal, Privacy, Compliance, IT, and Engineering to make it scalable and repeatable.
What you’ll do
You will lead and continuously improve Affirm's enterprise AI security review process evaluating the architecture, data flows, permissions, and design of internal AI tools, agentic/MCP-based systems, and AI features — and embed security requirements into the design phase.
You will threat model AI/LLM-based systems and their data flows for risks such as prompt injection, insecure output handling, excessive agency, tool-permission abuse, data poisoning, and sensitive-data exposure, and drive remediation.
You will review source code, system prompts, agent configurations, and tool/permission manifests (e.g., MCP definitions), and help tool owners build security-focused test cases and red-team/eval scenarios to verify requirements before launch.
You will design and build security guardrails and tooling for AI systems permission boundaries, authn/authz for agentic tools and MCP servers, data-handling controls, logging/monitoring, and policy-as-code (Python, IaC) — to enforce and automate AI security.
You will evaluate the AI capabilities of third-party SaaS vendors (e.g., Notion, Slack, Google Workspace) as part of vendor and SaaS security reviews and drive risk-based adoption decisions.
You will identify emerging classes of AI/agentic security vulnerabilities, develop mitigations before they become incidents, and contribute to AI-specific incident response playbooks as a senior escalation point.
You will lead cross-functional AI security initiatives to closure, advise technical and executive stakeholders as an internal point of expertise, and stay current on the AI security landscape (OWASP LLM Top 10, MITRE ATLAS) to translate new research into practical controls.
What we look for
You are a seasoned security engineer with hands-on experience designing, evaluating, and maintaining security architecture for AI/LLM-based systems, plus deep expertise in enterprise security systems, processes, and controls.
You have practical experience threat modeling and reviewing AI/LLM applications (e.g., against the OWASP Top 10 for LLM Applications) and securing agentic systems and tool-calling frameworks — MCP servers/clients, tool-permission models, and agent-to-tool trust boundaries.
You have built AI governance artifacts (acceptable use policy, data-handling standards, vendor/model risk assessments) and evaluated AI capabilities within SaaS platforms (e.g., Notion AI, Slack AI, Google Workspace AI, GitHub Copilot) as part of vendor reviews.
You have experience with enterprise tools for AI visibility and control (e.g., CASB, IDP/Okta) and familiarity with the corporate systems where AI is adopted (OpenAI, Anthropic, GitHub, Google Workspace, Slack, Notion, Jira).
You can build security tooling, guardrails, and detections with Python or similar, and deploy cloud services and policy-as-code using Infrastructure as Code (Terraform or similar); familiarity with Kubernetes and AWS.
You understand how LLMs and agentic systems are built (RAG, embeddings, fine-tuning, tool use) and authn/authz models (OAuth2, SAML, service-account/non-human identities) for agentic and machine-to-machine access, with strong application-architecture and threat-modeling fundamentals.
You can lead cross-functional initiatives across Security, Engineering, Legal, Privacy, and Compliance and drive them to closure, and communicate effectively with technical and executive audiences. Experience in regulated environments (SOC 2, PCI DSS) and applying IAM to non-human/agent identities is a plus.
This posting is for an existing vacancy
This remote role is open only to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan.
Base Pay Grade
- P
Equity Grade
- 7
Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.
Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company).
CAN base pay range per year:
$173,000 - $233,000
#Li-Remote
Remote-first with flexibility built in
Affirm is proud to be a remote-first company. Most roles can be done from almost anywhere within the country of employment. Some positions may occasionally require in-person work at an Affirm office, and a few are office-based due to the nature of the work. All new hires will be invited to attend an in-person onboarding experience.
Benefits designed for you
Our benefits reflect our commitment to care, transparency, and flexibility. Here are a few highlights:
Health coverage at no cost: We cover 100% of premiums for employees and their dependents.
Spending stipends: Monthly stipends support your tech setup, and the ability to choose health and wellness options that are right for you.
Time off to recharge: Flexible time off and generous holiday calendars help you rest when you need to.
Own a piece of what you build: Our employee stock purchase plan (ESPP) lets you buy Affirm stock at a discount.
We’re committed to providing an inclusive interview process, including accommodations for candidates with disabilities. If you need support, we’re happy to help.
For positions based in San Francisco or Los Angeles: Affirm considers qualified applicants with arrest and conviction records, as required by law.
By clicking "Submit Application," you acknowledge that you have read Affirm's
Global Candidate Privacy Notice
and consent to the use of your personal information as described.
Location: Remote US
At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most.
The InfoSec team protects Affirm’s systems and data from evolving threats. We manage security risk, monitor vulnerabilities, and enforce protective controls across the company. The team leads incident response, compliance, identity and access management, and employee training. Our goal is to ensure that security is built into every system and decision at Affirm. We maintain a secure, trustworthy environment so the business can operate and grow with confidence.
In this role, you'll build and run Affirm's end-to-end security review process for enterprise AI/LLM systems evaluating architecture, prioritizing AI-specific risks, and designing the controls and guardrails that let Affirm adopt AI safely, partnering across Security, Legal, Privacy, Compliance, IT, and Engineering to make it scalable and repeatable.
What you’ll do
You will lead and continuously improve Affirm's enterprise AI security review process evaluating the architecture, data flows, permissions, and design of internal AI tools, agentic/MCP-based systems, and AI features — and embed security requirements into the design phase.
You will threat model AI/LLM-based systems and their data flows for risks such as prompt injection, insecure output handling, excessive agency, tool-permission abuse, data poisoning, and sensitive-data exposure, and drive remediation.
You will review source code, system prompts, agent configurations, and tool/permission manifests (e.g., MCP definitions), and help tool owners build security-focused test cases and red-team/eval scenarios to verify requirements before launch.
You will design and build security guardrails and tooling for AI systems permission boundaries, authn/authz for agentic tools and MCP servers, data-handling controls, logging/monitoring, and policy-as-code (Python, IaC) — to enforce and automate AI security.
You will evaluate the AI capabilities of third-party SaaS vendors (e.g., Notion, Slack, Google Workspace) as part of vendor and SaaS security reviews and drive risk-based adoption decisions.
You will identify emerging classes of AI/agentic security vulnerabilities, develop mitigations before they become incidents, and contribute to AI-specific incident response playbooks as a senior escalation point.
You will lead cross-functional AI security initiatives to closure, advise technical and executive stakeholders as an internal point of expertise, and stay current on the AI security landscape (OWASP LLM Top 10, MITRE ATLAS) to translate new research into practical controls.
What we look for
You are a seasoned security engineer with hands-on experience designing, evaluating, and maintaining security architecture for AI/LLM-based systems, plus deep expertise in enterprise security systems, processes, and controls.
You have practical experience threat modeling and reviewing AI/LLM applications (e.g., against the OWASP Top 10 for LLM Applications) and securing agentic systems and tool-calling frameworks — MCP servers/clients, tool-permission models, and agent-to-tool trust boundaries.
You have built AI governance artifacts (acceptable use policy, data-handling standards, vendor/model risk assessments) and evaluated AI capabilities within SaaS platforms (e.g., Notion AI, Slack AI, Google Workspace AI, GitHub Copilot) as part of vendor reviews.
You have experience with enterprise tools for AI visibility and control (e.g., CASB, IDP/Okta) and familiarity with the corporate systems where AI is adopted (OpenAI, Anthropic, GitHub, Google Workspace, Slack, Notion, Jira).
You can build security tooling, guardrails, and detections with Python or similar, and deploy cloud services and policy-as-code using Infrastructure as Code (Terraform or similar); familiarity with Kubernetes and AWS.
You understand how LLMs and agentic systems are built (RAG, embeddings, fine-tuning, tool use) and authn/authz models (OAuth2, SAML, service-account/non-human identities) for agentic and machine-to-machine access, with strong application-architecture and threat-modeling fundamentals.
You can lead cross-functional initiatives across Security, Engineering, Legal, Privacy, and Compliance and drive them to closure, and communicate effectively with technical and executive audiences. Experience in regulated environments (SOC 2, PCI DSS) and applying IAM to non-human/agent identities is a plus.
Base Pay Grade - P
Equity Grade - 13
Employees new to Affirm typically come in at the start of the pay range.
Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.
Base pay is part of a total compensation package that may include equity rewards, monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents.)
USA base pay range (CA, WA, NY, NJ, CT) per year:
$220,000 - $280,000
USA base pay range (all other U.S. states) per year:
$195,000 - $255,000
#LI-Remote
Remote-first with flexibility built in
Affirm is proud to be a remote-first company. Most roles can be done from almost anywhere within the country of employment. Some positions may occasionally require in-person work at an Affirm office, and a few are office-based due to the nature of the work. All new hires will be invited to attend an in-person onboarding experience.
Benefits designed for you
Our benefits reflect our commitment to care, transparency, and flexibility. Here are a few highlights:
Health coverage at no cost: We cover 100% of premiums for employees and their dependents.
Spending stipends: Monthly stipends support your tech setup, and the ability to choose health and wellness options that are right for you.
Time off to recharge: Flexible time off and generous holiday calendars help you rest when you need to.
Own a piece of what you build: Our employee stock purchase plan (ESPP) lets you buy Affirm stock at a discount.
We’re committed to providing an inclusive interview process, including accommodations for candidates with disabilities. If you need support, we’re happy to help.
For positions based in San Francisco or Los Angeles: Affirm considers qualified applicants with arrest and conviction records, as required by law.
By clicking "Submit Application," you acknowledge that you have read Affirm's
Global Candidate Privacy Notice
and consent to the use of your personal information as described.
Задачи:
— Развивать и поддерживать production Kubernetes-кластеры (40+ сервисов, 20+ разработчиков).
— Проектировать инфраструктурные решения под рост нагрузки и отказоустойчивость.
— Принимать решения по развитию инфраструктуры и платформенных сервисов.
— Развивать GitOps-подход через FluxCD: управление релизами, окружениями, политиками.
— Писать и поддерживать Terraform-модули для управления облачной инфраструктурой.
— Строить и улучшать CI/CD пайплайны в GitLab CI вместе с командами разработки.
— Обеспечивать observability: метрики (Prometheus/Grafana), логи (ELK), алерты.
— Встраивать практики DevSecOps/FinOps.
— Делать ревью инфраструктурного кода коллег.
— Отвечать за здоровье и аптайм инфраструктуры.
Требования:
— Уверенное знание Linux.
— Понимание Docker и контейнеризации.
— Опыт настройки CI/CD.
— Опыт с Kubernetes.
— Опыт с GitOps-инструментами (FluxCD, ArgoCD).
— Опыт администрирования БД.
— Будет плюсом: Разрабатывали на Go или Java.
— Будет плюсом: Умеете работать с Terraform для управления инфраструктурой.
— Будет плюсом: Опыт внедрения Vault или аналогичных систем управления секретами.
— Будет плюсом: Опыт с кластерным Clickhouse.
— Будет плюсом: Опыт с поддержкой кластера Kafka.
— Будет плюсом: Опыт работы SRE.
— Будет плюсом: Выстраивал SLO/SLA для сервисов.
— Будет плюсом: Опыт с высоконагруженными проектами.
— Будет плюсом: Активное использование ИИ технологий.
Условия:
— Удаленный или гибридный формат работы на выбор.
— Уютный дизайнерский офис в пешей доступности от м. Арбатская или м. Кропоткинская.
— Вкуснейший кофе, чай, фрукты, овощи, снэки и сладости.
— Компенсация расходов на спорт, английский язык и другие профессиональные курсы.
— Подарки на День Рождения, Свадьбу, рождение ребенка.
— Реферальная система — бонус за приведенного сотрудника.
— Возможность посещения конференций, вебинаров и других мероприятий.
— Работа без бюрократии и ненужных ритуалов.
Задачи:
— Функциональное и системное сопровождение банковского программного обеспечения
— Сопровождение и развитие инфраструктуры банковского программного обеспечения
— Обеспечение доступности автоматизированных банковских процессов
— Осуществление технической поддержки пользователей и клиентов
— Накопление и передача технической экспертизы по архитектуре ИТ системы, а также по бизнес-процессам
— Развитие программно-инфраструктурного ландшафта банка
— Реализация пилотных проектов бизнеса
Требования к кандидату:
— Управление серверами на базе Linux на уровне администратора
— Знание микросервисной архитектуры и технологий контейнеризации: Docker, containerd
— Продвинутые навыки работы с Kubernetes, Helm, Kafka
— Понимание принципов построения процессов CI/CD
— Понимание принципов IaC. Продвинутые навыки работы с Ansible, Terraform, Terragrunt
— Понимание принципов построения Observability. Продвинутые навыки работы с ELK/EFK, OpenSearch, Prometheus, VictoriaMetrics
— Опыт работы с облачными провайдерами, например, AWS, Yandex Cloud
— Знание СУБД на уровне администратора: Redis, MongoDB
— Навыки программирования, например, на Python, GO, Java, JavaScript
— Kubernetes (не managed), Postgres/Patroni, Redis, Ansible, VictoriaMetrics/Prometheus, ELK/OpenSearch
— Образование высшее, профильное техническое
— Опыт работы от 3х лет
Условия работы:
— Оформление по ТК РФ или ИП в аккредитованную ИТ компанию
— ДМС со стоматологией
— Скидки на изучение иностранных языков от Skyeng
— Скидки на фитнес от Xfit
— Скидки на кино от КАРО
— Техника для работы
Location: Bremen, Germany
Supervisor:
Prof. Dr. Alexander Tormasov
About the Position
Constructor Knowledge Labs (CKL), in collaboration with Constructor Technology, invites applications for a PhD position in machine learning for software engineering and formal methods, on the Constructor Fabric project.
Constructor Fabric turns a company's informal knowledge into production software through a pipeline of composable capability units called
gears
: requirements → architecture → product fit → framework (G1) → application → runtime. We are building a
World Model
over that pipeline — a model that does not just generate code, but predicts the
consequences
of an architectural decision: total cost of ownership, unintended side effects, latency and failure behaviour, and whether a proposed composition is even admissible.
The central object is not a digital twin of the application but its
formal architectural skeleton
: gear contracts (GearSpec), a typed attributed hypergraph of the application (AppGraph), a composition algebra that defines which assemblies are legal, and several semantic projections (types, protocols, resources, security) over which properties are proved, refuted by counterexample, or reported as an explainable
gap
. All of it is written in a
domain-specific language
whose syntax trees and graphs we keep in a projectional editor (JetBrains MPS) — so the DSL is not a convenience layer, it is the thing that defines the model's state space and the boundary of what the model is allowed to propose.
What you will work on
Depending on your background, one or two of:
Formal skeleton and composition — GearSpec as a contract $(Requires, Provides, State, Effects, Assumptions, Guarantees, Parameters)$; AppGraph as a typed attributed hypergraph; an algebra of assembly (sequential, parallel, feedback, refinement); semantic projections and system-level invariants over trajectories.
Architecture synthesis as an inverse problem — given a specification, load and constraints, find the composition of gears that realises it. Constraint solving and MCTS as the baseline; a learned transition/value model for ranking and pruning; LLM proposals treated strictly as candidate hypotheses that a DSL parser, type checker and property checks must then admit or reject.
DSL design and language engineering — the gear DSL and its glue layer decide which AppGraphs are expressible at all, and therefore where the search space ends. This thread covers the abstract syntax and static semantics of that DSL; the requirement that an architectural decision be unbypassable by construction (you must not be able to wire authentication around the Auth Resolver); what happens to the language when gear contracts change or a 201st gear is added; projectional representation of graphs with cycles; and the open hypothesis that a specialised G1-DSL is generated together with every G1.
Local transition models and pipeline surrogates — fast approximate predictors for single pipeline steps (spec change → code quality, architecture → product fit, app → runtime outcome), with calibrated uncertainty, validated against real telemetry.
Data — reconstructing (specification → architecture) pairs from open repositories at scale, plus synthetic project generation from a fixed gear set and DSL grammar to cover rare transitions, gaps and counterexamples.
Profile
MSc (or equivalent) in computer science, mathematics, or a mathematical natural science.
Coursework in compilers, programming-language theory, language design or model-driven engineering is a strong positive signal, half of this project is deciding what a formal architecture description is allowed to say.
Evidence that you finish things: a maintained open-source repository, a peer-reviewed publication, or a strong competition result.
Fluent technical English.
Most importantly: the habit of stating an assumption explicitly and designing an experiment that could falsify it.
Required mathematical background
Core skills:
Probability and statistics. Estimation, Bayesian inference, uncertainty quantification and calibration (proper scoring rules, reliability diagrams, ECE), experiment design and significance testing. A prediction we cannot calibrate is not usable here.
Linear algebra and multivariate calculus at the level needed to derive, not just call, a training objective: matrix calculus, gradients, stochastic optimisation, conditioning.
Discrete mathematics and graph theory. Typed and attributed graphs and hypergraphs, subgraph matching and isomorphism, graph rewriting, reachability, basic complexity classes.
Mathematical logic and formal methods. First-order logic, type systems, SAT/SMT, temporal logic (LTL/CTL) and model checking, pre/post-conditions, invariants, refinement.
Sequential decision making. MDP/POMDP, dynamic programming, model-based RL, latent state-space (world) models, Monte-Carlo Tree Search.
Strong command of at least one, working knowledge of a second:
Formal languages, semantics and language engineering — grammars (context-free, attribute and graph grammars), derivation and reachability, parsing; abstract versus concrete syntax; operational and denotational semantics; metamodelling, model-driven engineering, model-to-model transformation, and projectional (structural) editing of the kind JetBrains MPS implements. We are asking for the education, not the tool: you should know why a projectional editor exists, what a metamodel buys you over a text grammar, and how a language evolves without breaking its existing models. Hands-on MPS experience is explicitly not required — we will teach it.
Category theory for compositional systems — monoidal and traced monoidal categories, functors as semantic projections, string diagrams, operads. This is the language of our assembly algebra.
Causal inference — structural causal models, do-calculus, counterfactuals, identifiability. Required for the "what happens if we replace this technology / move on-premises" class of questions, which similarity search alone cannot answer.
Queueing theory and applied stochastic processes — M/M/1 and networks of queues, heavy tails, retries, timeouts, partial failure and reliability models. This is the resource and stochastic projection.
Combinatorial optimisation, constraint programming and program synthesis theory — CEGIS, version-space algebras, symmetry breaking, search heuristics.
Representation learning theory — VAEs and latent dynamics, GNN expressiveness (Weisfeiler-Leman hierarchy), permutation equivariance, embedding migration under a changing vocabulary.
Required hands-on programming skills
This is an engineering-heavy PhD. We expect code that another person can clone, run and reproduce — not notebooks that worked once.
Must have:
Python (professional level). Type hints, packaging, `pytest`, profiling, `asyncio`, memory-aware data structures. You write unbuffered, logged, restartable long-running jobs by default.
Training loops written from scratch, custom datasets and collation, mixed precision, multi-GPU; experiment tracking (W&B or MLflow), configuration management (Hydra), strict seed and artefact reproducibility.
Graph machine learning. PyTorch Geometric or DGL — message passing, heterogeneous and typed graphs, graph transformers, handling graphs whose node vocabulary changes between versions.
Solvers and verification tooling driven from Python. Z3 or cvc5 hands-on; demonstrated exposure to at least one model checker (TLA+/TLC, SPIN, NuSMV, Alloy) or proof assistant (Lean, Coq, Isabelle).
Code as data. AST manipulation, `tree-sitter`, static analysis, dependency and interface graph extraction, large-scale repository mining.
Parallel data pipelines. `multiprocessing`, Ray or Dask; checkpointing, heartbeats, cost estimation before launching a run that touches millions of files.
LLM engineering. API orchestration, structured and grammar-constrained decoding, evaluation harnesses, token/cost accounting — with the discipline to treat model output as a hypothesis subject to formal checks.
Linux, git, code review, shell.
Desirable:
Language tooling you have actually used: ANTLR, Xtext, Lark, or a parser, type checker or interpreter you wrote yourself. Our internal representation of gear syntax trees and graphs lives in JetBrains MPS — again, we do not ask for MPS experience, only that you are comfortable reading and extending a metamodel; Java/Kotlin literacy helps once you get there.
JAX, or compiler / SAT-SMT internals.
Infrastructure literacy — Docker, Kubernetes, Terraform, OpenTelemetry/Prometheus — since the resource projection is calibrated against real deployment telemetry.
One systems language (Rust, Go or C++) for performance-critical search.
Prior experience with production software architecture, or with a brownfield system you had to change without breaking.
Funding
The appointment provides full financial coverage through a dedicated fellowship, comprising:
Monthly stipend of €1,650
Monthly research-cost allowance of €100 (Forschungskostenpauschale)
Health-insurance subsidy of €100 per month
Location:
Bremen, Germany
Duration:
3 years, full time
Start date:
November 2026
Application package must include
CV, including publications, code, or research projects.
Cover letter (1–2 pages) explaining your motivation, research interests, and fit with the project.
A link to code you have written.
A one-page research statement picking one open research question from the project and sketching how you would approach it.
Master’s and Bachelor’s degree certificate and transcripts.
Contact information for 2–3 academic referees.
Applications are reviewed on a rolling basis. Shortlisted candidates will be invited to interviews.
Задачи:
— Участвовать в проектировании и реализации высокопроизводительных, масштабируемых и оптимизированных дата-решений.
— Создавать модели данных с нуля, используя сильные навыки SQL.
— Писать и оптимизировать SQL-запросы внутри приложений.
— Обеспечивать производительность, безопасность и доступность баз данных.
— Готовить документацию и технические спецификации.
— Выполнять процедуры с базами данных: обновления, резервное копирование, восстановление и миграция.
— Профилировать использование ресурсов сервера и оптимизировать конфигурации.
— Проектировать, строить и автоматизировать развертывание дата-пайплайнов и приложений.
— Интегрировать данные из локальных баз и внешних источников через REST API и инструменты сбора данных.
— Сотрудничать с бизнес-подразделениями и командами дата-сайенс по вопросам доступа, трансформации, обработки и отчетности данных.
— Поддерживать внедрение, технические вопросы и обучение, связанные с экосистемой data lake.
— Управлять AWS-ресурсами, включая кластеры EMR и ECS.
— Поддерживать обеспечение, мониторинг, конфигурацию и обслуживание AWS-инструментов.
— Оценивать и внедрять новые облачные технологии для улучшения возможностей и снижения затрат.
— Поддерживать автоматизацию с использованием Infrastructure as Code (Terraform) и CI/CD (Jenkins).
— Реализовывать управление данными, контроль доступа и снижение рисков безопасности.
Требования:
— 7-9 лет опыта проектирования и разработки облачных моделей данных, ETL-пайплайнов и инфраструктуры.
— Опыт работы с структурированными и неструктурированными данными.
— Отличное владение SQL для популярных баз данных.
— Опыт оптимизации больших и сложных SQL-запросов.
— Знание лучших практик реляционных баз данных.
— Опыт настройки движков баз данных и оркестрации кластеров.
— Умение планировать ресурсы по высоким спецификациям.
— Навыки устранения типичных проблем с базами данных.
— Опыт работы со Spark, Glue, EMR, Apache Kafka или AWS Kinesis.
— Опыт с системами контроля версий Git или Subversion.
— Опыт использования автоматизированных систем сборки и CI/CD.
— Программирование на Java, Python и Scala.
— Знание структур данных и алгоритмов.
— Знание реляционных, NoSQL, графовых, документных, key-value и временных баз данных.
— Знание масштабируемого проектирования и управления моделями данных.
— Знание деплоя ML-моделей.
— Знание AWS cloud платформ.
— Знание TDD и BDD.
— Сильный интерес к улучшению навыков разработки ПО, фреймворков и технологий.
Условия:
— Возможность работать с моделированием данных, сервисами данных и дата-сайенсом в рамках платформы Data Intelligence.
— Работа в разнообразной технической среде: AWS, ETL-пайплайны, базы данных, поисковые технологии, рекомендательные системы.
— Прямое взаимодействие с командами дата-сайенс и внутренними заинтересованными сторонами по вопросам отчетности, трансформации и возможностей платформы.
Location: Renton, Washington, United States
We take play seriously. We’re looking for curious adventurers ready to find their party, fueled by imagination and drive to build what’s never been built before. At Hasbro and Wizards of the Coast, you’ll collaborate with passionate teams to reimagine our iconic brands and create experiences that spark joy, connection, and community through the magic of play. This is your chance to shape legendary play that lasts a lifetime.
Job Overview
The cloud platform underpins how services are built, deployed, secured, and operated across the organization.
As a Principal Cloud Infrastructure Engineer, you will define and drive the governance model and automation strategy for cloud infrastructure. This includes setting policy-as-code standards, automating compliance and cost controls, and ensuring infrastructure is provisioned and operated through consistent, auditable, self-service pathways rather than tailored or manual processes.
You will operate at both a strategic and hands-on level and will set direction for how cloud resources are governed and automated while also building the tooling and guardrails that make that direction real. Success in this role means engineering teams can self-service the build and operation of infrastructure with confidence that it is secure, cost-aware, and consistent by default, without slowing delivery down.
Location and Work Arrangement
This role is based at our Renton, Washington office and follows a hybrid schedule designed to support in-person collaboration. Employees are expected to work onsite on Tuesdays, Wednesdays, and Thursdays, with the flexibility to work remotely or onsite on Mondays and Fridays.
What You'll Do
Define and enforce policy-as-code standards (tagging, naming, encryption, network segmentation, access boundaries) across cloud accounts/subscriptions
Establish guardrails using tools such as Open Policy Agent (OPA), Sentinel, AWS Config/Service Control Policies to report on and prevent drift from approved patterns
Partner closely with Security/Identity and Access Management (IAM) to deliver least-privilege enforcement and access-control requirements directly in our self-service capabilities while ensuring compliance and auditability
Embed cost governance and reporting (budgets, anomaly detection, showback/chargeback) into provisioning workflows
Drive the organization's Infrastructure-as-Code standards (e.g., Terraform/Terraform Cloud, Pulumi)
Establish and maintain reusable, versioned modules and contribution standards that embed governance requirements by default.
Automate environment provisioning, drift detection/remediation, and lifecycle management so policy compliance doesn't depend on manual review
Stay ahead of AI-native tooling and bring forward practical opportunities balancing risk, fit, value, measurability, and alignment to company goals.
Develop golden paths for infrastructure provisioning and service deployment that make the guided path the easiest path
Partner on developer platform tooling and integrations (continuous integration and continuous delivery (CI/CD), container registries, managed data services, observability) where they intersect with governance and automation.
What You'll Bring
8+ years in cloud engineering, DevOps, or platform engineering, including experience operating at a principal or staff level (setting direction, not just implementing)
Deep experience with major Cloud Platforms (AWS, Azure, or Google Cloud Platform (GCP)), ideally across more than one
Deep hands-on experience with Infrastructure-as-Code (Terraform and/or Pulumi) at scale, including module design and state/workspace management
Direct experience implementing policy-as-code and cloud governance frameworks
Experience with cloud cost management/FinOps practices and tooling
Familiarity with continuous integration and continuous delivery (CI/CD) platforms, container registries, and observability tooling as consumers of the standards you build
Ability to influence across platform, security, FinOps, and product engineering teams without direct authority
Strong documentation and communication skills; able to make the case for standards to both engineers and leadership
Experience mentoring engineers and setting technical direction beyond your own immediate team
Experience with platform advocacy, working with partners to understand infrastructure needs in collaboration with Product.
What Sets You Apart
Exposure to applying AI tooling to infrastructure problems (policy review, anomaly detection, automation) is a plus
Who We Are
We’re a team of creators, storytellers, and innovators united under the Hasbro family and home to beloved brands, AAA digital games studios and immersive experiences that spark imagination across generations. Together, we’re committed to a culture rooted in creativity, excellence, curiosity, and inclusion, and where every employee is empowered to think boldly, act with integrity, and spark joy for all.
Hasbro
About the Company – Hasbro
Wizards of the Coast
Who We Are – Wizards of the Coast
Equal Opportunity
Hasbro is committed to equality of opportunity in all aspects of employment. We are committed to making all employment decisions without regard to race, color, religion, sex, sexual orientation, gender identity or expression, national origin, age, marital status, or any other legally protected status.
Accommodations
If you have a disability and need reasonable accommodation during the hiring process, please inform your recruiter anytime throughout the process.
Notice Regarding Hasbro’s use of AI in the Recruitment Process
We use Greenhouse’s AI-powered Talent Matching tool to compare your application against our job requirements.
How it works: Talent Matching compares information from your resume and application responses with job-related criteria established and weighted by Hasbro’s recruiting and hiring teams. Depending on the role, these criteria may include relevant skills, work experience, prior job titles, and industry experience. The tool then assigns a match category to help organize applications for review.
Human oversight: Talent Matching supports — but does not replace — human review. It does not automatically advance or reject candidates or make employment decisions. Hasbro’s recruiters and hiring managers review applications and remain responsible for all hiring decisions.
Greenhouse has published the results of an independent bias audit of Talent Matching.
View the Greenhouse Talent Matching audit results
.
#Wizards
The pay transparency range for this role is listed below. The hiring range will vary based on factors such as experience, skills, location and market conditions. Additionally, employees may be eligible for annual and long-term incentives as part of their overall compensation package.
Pay Range
$172,600
—
$259,000 USD
Employees may be eligible for annual and long-term incentives as part of their overall compensation package, depending on role, location, and eligibility. Benefits and programs may include:
Health & Wellness
Time Off to Recharge
Financial Well-being
Life & Family Support
Volunteer and Community Initiatives
Learning & Development
Exclusive Perks
Please review our
Applicant Privacy Notice
to learn how we collect, use, and protect your personal information in connection with the application process.
Location: St. Petersburg, Russia; Moscow, Russia; Belgrade, Serbia
Workplace: remote
At
NOVACARD
, we’re redefining how people use
credit. We
are the
first interest-free and no-annual-fee credit card in Mexico
, designed to simplify personal finances and give users complete control - all from a mobile app. With NOVACARD, users can access up to
$200,000 MXN in credit
, only pay when they use it, and manage everything digitally in under 5 minutes. Our mission is to empower people to make smarter financial decisions by offering flexibility, transparency, and the freedom they need to reach their goals. Simple finances, big goals.
About the Role:
We’re looking for a DevOps Engineer to design, deploy, and operate AWS infrastructure for a large-scale migration of a digital financial product. You’ll build and maintain a production-ready platform covering AWS networking, Kubernetes/EKS, CI/CD, observability, backup/restore, and secure access management. You’ll collaborate closely with development, system analysis, QA, and engineering teams to ensure fast delivery, stable services, and a controlled migration.
Key Responsibilities:
AWS Infrastructure Design & Operations
Design, deploy, and maintain AWS infrastructure: VPC, Subnets, Route Tables, Security Groups, IAM, EC2, EBS, S3, ELB/ALB/NLB, Route53.
Configure AWS networking: public/private subnets, NAT Gateway, Internet Gateway, VPC Peering / Transit Gateway, VPN, routing.
Ensure HA, backup/restore, disaster recovery, and production infrastructure principles.
Create and maintain AWS infrastructure as code using Terraform.
Kubernetes & Containerization
Build and operate Kubernetes on AWS (EKS).
Work with core Kubernetes objects: Deployment, StatefulSet, DaemonSet, Service, Ingress, ConfigMap, Secret, Job/CronJob, PVC/PV, Namespace, ServiceAccount.
Use Helm for application management.
Configure Ingress Controller, Load Balancer, and TLS/certificates.
Understand Kubernetes storage and ensure stateful applications run reliably.
Work with Docker: image builds, registry, container troubleshooting.
CI/CD & Automation
Build CI/CD processes, preferably with GitLab CI.
Automate deployment of applications and dependent services.
Integrate infrastructure changes into pipelines and maintain reproducible environments.
Observability, Reliability & Operations
Set up monitoring with Prometheus + Grafana: metrics and alerts.
Organize centralized log collection and analysis: Loki/ELK/OpenSearch.
Diagnose network and system issues in Linux.
Ensure production stability, respond to incidents, and eliminate root causes.
Security & Access Management
Manage secrets: AWS Secrets Manager / Vault/OpenBao / External Secrets.
Configure RBAC/IAM and follow the principle of least privilege.
Ensure secure service-to-service communication and infrastructure access.
Data & Services
Support PostgreSQL, Redis, RabbitMQ/Kafka at the infrastructure and application integration level.
Ensure backup/restore and fault tolerance for stateful services.
Help teams deploy and maintain dependent services in Kubernetes.
Key Requirements:
AWS & Networking
Strong AWS experience: VPC, Subnets, Route Tables, Security Groups, IAM, EC2, EBS, S3, ELB/ALB/NLB, Route53.
Good understanding of AWS networking: public/private subnets, NAT Gateway, Internet Gateway, VPC Peering / Transit Gateway, VPN, routing.
Kubernetes & Containers
Hands-on experience building and operating Kubernetes on AWS (EKS).
Understanding of core Kubernetes objects: Deployment, StatefulSet, DaemonSet, Service, Ingress, ConfigMap, Secret, Job/CronJob, PVC/PV, Namespace, ServiceAccount.
Experience with Helm.
Experience configuring Ingress Controller, Load Balancer, and TLS/certificates.
Experience with Docker: image builds, registry, container troubleshooting.
Understanding of Kubernetes storage and stateful application operation.
IaC & CI/CD
Terraform — creating and maintaining AWS infrastructure as code.
Experience building CI/CD, preferably GitLab CI.
Data, Queues & Storage
Experience with PostgreSQL, Redis, RabbitMQ/Kafka at the infrastructure and application integration level.
Understanding of HA, backup/restore, disaster recovery, and production infrastructure principles.
Monitoring, Logging & Secrets
Monitoring: Prometheus + Grafana, configuring metrics and alerts.
Centralized log collection and analysis: Loki/ELK/OpenSearch.
Secrets management: AWS Secrets Manager / Vault/OpenBao / External Secrets.
Linux & Security
Linux administration and confident diagnosis of network and system issues.
Experience configuring RBAC/IAM and following the principle of least privilege.
Especially Important Practical Experience:
The engineer must be able to design an AWS network from scratch → set up EKS → deploy an application and dependent services → configure ingress/DNS/TLS → CI/CD → monitoring/logging → backup → hand over a production-ready infrastructure for operation.
Nice to Have:
Experience migrating lending systems or fintech products.
Experience building CI/CD with GitLab CI.
Hands-on experience with Vault/OpenBao, External Secrets.
Experience with Kafka and stateful services in Kubernetes.
What We Offer:
Participation in a large-scale migration of a digital financial product.
Work with a modern stack: AWS, Kubernetes/EKS, Terraform, CI/CD, Prometheus/Grafana.
Close collaboration with development, system analysts, QA, and engineers.
Opportunity to build a production-ready platform from scratch and hand it over to operations.
Terms and work format — discussed individually
Location: Lisbon, Portugal
Joom is a global cross-border marketplace where millions can find anything they want at fair prices. Joom helps consumers to make shopping easy and entertaining and provides access to interesting and unique goods from around the world.
Joom is one of the key businesses of Joom Group, an international group of tech-centric group of e-commerce companies founded in 2016 in Latvia. Joom also includes other businesses: JoomPro, the first and only end-to-end cross-border B2B marketplace; JoomPulse, an AI analytics tool for Mercado Livre sellers; and Onfy, a pharmaceutical marketplace in Germany. Joom Group has offices in Latvia, China, Germany, and Brazil, with its headquarters in Lisbon, Portugal. We work as one international team, sharing knowledge and collaborating across countries, businesses and products.
We are currently looking for
Senior/Middle+ Backend Developers
to join our teams:
JoomPro
is the first and only end-to-end cross-border B2B marketplace. It serves small, medium, and large businesses, handling orders of any size from start to finish. Today, JoomPro operates in Brazil and Mexico, with plans to expand into other markets.
Tech stack:
Go, MongoDB, Redis, Kafka, Amazon AWS, Docker, Kubernetes, Elasticsearch
The Development Infrastructure team
is responsible for the uninterrupted operation of internal services, the fault tolerance of components, the evolution of the codebase architecture, as well as creating and maintaining tools for developers.
Tech stack:
Go, Bazel, Jenkins, Kubernetes, Helm, KCL, Terraform, MongoDB, Postgres
The Antifraud Infrastructure team
is responsible for ensuring platform security, including infrastructure protection, bot management, user device authorization, personal data storage, and preventing data leaks.
Tech stack:
Go, Kotlin, MongoDB, Cassandra, Redis, Kafka, Spark (Scala, SQL), Amazon AWS, Docker, Kubernetes, ML
The Client Backend team
is responsible for all API requests coming from our mobile apps and Joom's web client.
Tech stack:
Go, MongoDB, Redis, Casandra, Kafka, sometimes Spark (Scala, SQL), Docker, Kubernetes, Grafana, Prometheus
Responsibilities
Come up with architecture
Program in Go
(Go is not a must for us; it is more important for a successful candidate to have solid algorithm skills, fundamental technical knowledge, and great coding skills in general)
Provide fault tolerance for coded services in an AWS environment
Be prepared for a constant increase of processed and stored data loads and volumes
Participate in new feature and product development discussions
Requirements
Confident knowledge of any of the programming languages: Go/Java/Kotlin/C++/Python/Scala
Complex project development experience
Excellent algorithmic training
Experience in development for Linux / Unix
Preferred
Experience with highload
Experience with MongoDB
Experience with Kubernetes
We offer
Compensation package: base salary and performance-based bonuses
Office-first: flexible hours with a possibility to work remotely 52 days per year
Care & Wellbeing: health insurance (including dental care) for employees and their children, daily meal allowance, and 100% paid sick leave
Relocation Support: full assistance for a smooth relocation for the employees and their family
AI-first approach: licenses and access to a wide range of AI tools
Team & Growth: collaboration with colleagues across Portugal, Brazil, Latvia and China, with opportunities for promotions, professional trainings, and English & Portuguese courses
Community & Engagement: annual team building activities, knowledge-sharing workshops, and a strong sense of team work
Before applying for the above position please review our Candidate Privacy Notice
here
. By responding to the vacancy, you acknowledge that you have read our Privacy notice.
Location: Hamburg
Workplace: Hybrid
adjoe builds the technologies behind mobile apps growth and monetization. With our core product Playtime Arcade, we've become the global leader in rewarded advertising, an ad unit built on a simple premise: users earn real in-app rewards for engaging with new apps. The result is one of the most effective value exchanges in adtech, connecting advertisers and publishers with over 770 million users annually.
Keeping Platform Stability Front and Center for 770M+ Users
On the frontier of adjoe's most critical publisher relationships, the Product Operations team moves fast, cuts through complexity, and keeps our entire platform running. Operating across the full adjoe stack—backend services, SDKs, catalog, and integrations—we unblock strategic launches, build custom integrations, and resolve critical issues in production.
We act as the safety net for our product teams and the first line of defense for enterprise publishers like Venmo and PayPal. Beyond immediate troubleshooting, we build and scale high-impact diagnostic tooling to automate root-cause resolution across client-side and microservice architectures. Combining cross-stack technical depth with rapid execution, Product Operations ensures seamless performance wherever enterprise growth meets global scale.
Your Mission & Who We Are Looking For:
- 5+ years in Go, built for scale. You have 3+ years building production Go services and know how to profile and optimize applications under real traffic, not just identify bottlenecks, but eliminate them. You've worked on large Go applications with considerable daily request volume.
- Distributed systems are your default context. You design and operate microservice architectures using Kafka and SQS/SNS for reliable asynchronous communication, and are responsible for collecting and aggregating billions of daily API events into Kafka streams queryable from the data lake in seconds.
- Data performance matters at every layer. You work with Druid, MySQL, Redis, and DynamoDB, optimizing queries and data access patterns to deliver few-millisecond response times. You know the tradeoffs between different storage solutions and when each one is the right tool.
- Bridge product and Data Science. You collaborate directly with Data Scientists to integrate ML algorithms that optimize ad delivery: translating complex mathematical solutions into production-ready backend services.
- Partner-facing data ownership. You support partners through well-documented open APIs, providing raw or aggregated data transparently based on their business needs.
- Infrastructure fluency is part of the job. You have hands-on experience with Terraform, Docker, and serverless infrastructure, owning services end-to-end from development to production.
🌎 We welcome applications from talent worldwide and provide relocation support to Hamburg, Germany for those ready to join our team.
What’s in It for You?
At adjoe, you’re not here to just close JIRA tickets, you’re helping build the infrastructure behind one of the most impactful platforms in adtech. The systems you work on will reach hundreds of millions of users and power billions of decisions every day.
- Go Big. Own projects with impact on 770M users and push adtech boundaries.
- Move Fast. Ship solutions multiple times a day, learn from results, and keep momentum.
- Be Direct. Solve problems openly and collaborate across teams.
- Thrive Together. Grow with a diverse, global team of people from over 40 different countries that learn from each other.
- Have Fun. Celebrate wins, enjoy daily victories, and bring your energy.
We welcome applications from people who will contribute to the diversity of our company.
Заказчик — крупный российский ритейлер.
Проект связан с масштабной миграцией инфраструктуры и приложений в Yandex Cloud: перенос Kubernetes-приложений со старых версий Kubernetes, миграция виртуальных машин и баз данных, а также перевод CI/CD-процессов с Bamboo на GitLab CI.
Работа ведётся в команде заказчика под руководством проектного менеджера.
Обязательные требования
— Не менее 3 лет коммерческого опыта в направлениях DevOps, SRE или Platform Engineering.
— Практический опыт работы с сервисами Yandex Cloud: Compute Cloud, VPC, Managed Service for Kubernetes, Object Storage, а также с managed-сервисами баз данных.
— Уверенное владение Kubernetes и Helm.
— Опыт адаптации приложений — перенос решений со старых версий Kubernetes на актуальные.
— Навыки работы с Terraform либо OpenTofu, в том числе с готовыми IaC-модулями.
— Знание особенностей устаревания (deprecation) API Kubernetes, включая типовые сложности при миграции с Kubernetes 1.11.
— Опыт разработки и поддержки CI/CD-пайплайнов в GitLab.
— Опыт переноса CI/CD-процессов из Bamboo или схожих систем.
— Практические навыки Linux-администрирования, настройки виртуальных машин и сетевых параметров.
— Опыт миграции баз данных — в частности, PostgreSQL, MySQL либо других СУБД, задействованных в проекте.
— Способность следовать установленным шаблонам и инженерным стандартам, а также фиксировать изменения в документации.
— Готовность к работе в команде заказчика под руководством проектного менеджера.
Дополнительные требования
— Практический опыт работы с Yandex Managed Service для PostgreSQL, MySQL, Redis и Kafka.
— Навыки применения GitOps-инструментов Argo CD, FluxCD.
— Опыт использования Container Registry.
— Владение Helmfile и Kustomize.
— Опыт переноса legacy-приложений и миграции устаревших Kubernetes-кластеров.
— Участие в крупных миграционных проектах с параллельными потоками работ.
Задачи на проекте
Подготовка к миграции
— Изучение существующих шаблонов развёртывания: Terraform-модулей, Kubernetes-манифестов, Helm-чартов, GitLab CI-шаблонов и эксплуатационных инструкций.
— Техническая инвентаризация переносимого приложения или компонента: контейнеры, зависимости, конфигурация, секреты, хранилища, БД, сетевые взаимодействия.
— Оценка технической готовности компонентов к переносу и выявление отклонений от типовых шаблонов.
— Согласование выявленных технических блокеров и нестандартных решений с представителями заказчика.
Миграция Kubernetes-приложений
— Подготовка приложений, работающих в Kubernetes 1.11, к развёртыванию в целевом Kubernetes-кластере Yandex Cloud.
— Адаптация манифестов, Helm-чартов и иных deployment-конфигураций под актуальную версию Kubernetes и принятые на проекте шаблоны.
— Устранение использования устаревших Kubernetes API и несовместимых параметров конфигурации.
— Настройка параметров приложений: ConfigMap, Secret, Ingress, Service, PersistentVolumeClaim, resource limits/requests, probes и других необходимых сущностей.
— Выполнение развёртывания и технической проверки работоспособности в согласованных окружениях.
— Подготовка технических процедур отката в рамках принятого процесса релизов.
— Переключение сервисов в новое окружение.
Перенос ВМ и сервисных компонентов
— Перенос прикладных компонентов с on-premise ВМ в Yandex Cloud с использованием существующих шаблонов и подходов проекта.
— Развёртывание и настройка целевых ВМ, если компонент не переводится в managed-сервис.
— Перенос баз данных и сервисных компонентов в определённые заказчиком managed-сервисы Yandex Cloud либо на целевые ВМ.
— Миграция данных по утверждённой процедуре.
— Техническая валидация: доступность сервиса, сетевые соединения, корректность конфигурации, целостность данных и запуск приложений.
Трансформация с Bamboo на GitLab CI
— Анализ действующих Bamboo-планов конкретных переносимых приложений.
— Перенос логики сборки, тестирования, упаковки и деплоя в GitLab CI.
— Использование существующих на проекте GitLab CI-шаблонов и общих компонентов пайплайнов.
— Настройка передачи артефактов, кэширования, переменных окружения и правил запуска jobs в соответствии с принятыми стандартами проекта.
— Настройка деплоя в согласованные окружения и механизма отката, предусмотренного действующим процессом.
— Проверка пайплайнов на тестовом и целевом окружениях.
Документирование и передача результатов
— Ведение технической документации по каждому перенесённому компоненту.
— Фиксация отклонений от шаблонных решений, принятых workaround'ов и известных ограничений.
— Подготовка инструкций по запуску миграции, валидации, деплою и откату.
— Участие в технических статус-встречах, предоставление актуального статуса и информации о блокерах проектному менеджеру заказчика.
Задачи:
— Функциональное и системное сопровождение банковского программного обеспечения
— Сопровождение и развитие инфраструктуры банковского программного обеспечения
— Обеспечение доступности автоматизированных банковских процессов
— Осуществление технической поддержки пользователей и клиентов
— Накопление и передача технической экспертизы по архитектуре ИТ системы, а также по бизнес-процессам
— Развитие программно-инфраструктурного ландшафта банка
— Реализация пилотных проектов бизнеса
Требования:
— Управление серверами на базе Linux на уровне администратора
— Знание микросервисной архитектуры и технологий контейнеризации: Docker, containerd
— Продвинутые навыки работы с Kubernetes, Helm, Kafka
— Понимание принципов построения процессов CI/CD
— Понимание принципов IaC, продвинутые навыки работы с Ansible, Terraform, Terragrunt
— Понимание принципов построения Observability, продвинутые навыки работы с ELK/EFK, OpenSearch, Prometheus, VictoriaMetrics
— Опыт работы с облачными провайдерами, например, AWS, Yandex Cloud
— Знание СУБД на уровне администратора: Redis, MongoDB
— Навыки программирования на Python, Go, Java, JavaScript
— Важно: kubernetes (не managed), postgres/patroni, redis, ansible, victoria metrics/prometheus, elk/opesensearch
— Желательно: istio, mongo, minio, clickhouse, qdran, ebula, litellm
— Работа с llm моделями инференсом и т.д.
— Образование высшее, профильное техническое
— Опыт работы от 3 лет
Условия:
— Оформление по ТК РФ или ИП в аккредитованную ИТ компанию
— ДМС со стоматологией
— Скидки на изучение иностранных языков от Skyeng
— Скидки на фитнес от Xfit
— Скидки на кино от КАРО
— Техника для работы
Контакты для отклика: @ivmargarita https://t.me/ivmargarita
Задачи:
— Архитектура и развертывание корпоративной инфраструктуры Azure с использованием Terraform/Bicep, поддержка модульных библиотек IaC и управление состоянием.
— Обслуживание, патчинг и оптимизация кластеров Azure Kubernetes Service (AKS), управление автоскейлингом, маршрутизацией ingress и политиками service mesh.
— Проектирование, поддержка и обеспечение безопасности автоматизированных CI/CD пайплайнов в Azure DevOps или GitHub Actions для ускорения циклов деплоя.
— Применение Azure Policy, аудит ролей IAM через Entra ID, управление ротацией секретов в Key Vault, устранение уязвимостей с помощью Defender for Cloud.
— Мониторинг метрик системы, реагирование на инциденты инфраструктуры, проведение RCA и оптимизация использования ресурсов для снижения затрат.
Требования:
— Опыт работы не менее 5 лет с Microsoft Azure, включая compute, сети (VNets, ExpressRoute, Application Gateways) и уровни хранения.
— Продвинутые навыки Terraform или Bicep для автоматизации, обнаружения дрейфа и управления состоянием в мульти-подписочных средах.
— Опыт построения, защиты и масштабирования AKS, управление ingress контроллерами и деплой приложений с Helm.
— Глубокое понимание построения CI/CD с Azure DevOps или GitHub Actions, включая автоматическое сканирование безопасности, соблюдение политик и безотказные релизы.
— Знания в области безопасности облака с Microsoft Entra ID, Azure Key Vault, Azure Policy и RBAC в модели Zero Trust.
— Опыт настройки мониторинга и алертинга с Azure Monitor, Log Analytics, Application Insights или сторонними платформами (Datadog, Dynatrace).
— Локация в часовом поясе CET (+/- 3 часа).
Желательно:
— Сертификаты Azure AZ-104, AZ-305, AZ-400.
— Навыки программирования на Python, Go, PowerShell или Bash для скриптинга инфраструктуры.
— Опыт оптимизации затрат в облаке (FinOps) и управления политиками Azure Cost Management.
— Знакомство с гибридными облачными конфигурациями или Azure Arc.
Условия:
— Своевременная оплата с гибкими вариантами вывода средств.
— Предсказуемый график работы: 8 часов в день.
— До 24 дней гибких выходных в год для полноценных позиций.
— Долгосрочные удалённые позиции в ведущих компаниях.
— Персонально подобранные вакансии без типичных рекрутинговых барьеров.
— Единый процесс контрактации для множества возможностей без дополнительных оценок.
— Стабильная ежемесячная оплата через Proxify.
УдалённоseniorLocated in CET timezone (+/- 3 hours), we are unable to consider applications from candidates in other time zones
Задачи:
— Архитектура, создание и поддержка инструментов самообслуживания платформы и порталов разработчиков, позволяющих командам самостоятельно обеспечивать инфраструктуру, управлять окружениями и развёртывать сервисы.
— Поддержка автоматизированных GitOps пайплайнов доставки с использованием ArgoCD/Flux, внедрение безопасных практик деплоя (canary, blue-green, автоматические откаты).
— Поддержка здоровья кластеров, жизненных циклов обновлений, политик автоскейлинга и безопасности в мульти-региональных Kubernetes-развёртываниях.
— Написание production-кода на Go/Python для создания кастомных Kubernetes операторов, CLI-утилит и API-автоматизации для оптимизации рабочих процессов разработчиков.
— Внедрение платформенных SLI/SLO, централизованного логирования и трассировки, а также автоматизация политик безопасности и контроля затрат.
Требования:
— Опыт 5+ лет в platform engineering, site reliability engineering (SRE) или core DevOps с подтверждённым опытом проектирования и внедрения Internal Developer Platforms (IDP).
— Экспертное владение Kubernetes, архитектурами кастомных контроллеров/операторов, сервис-мешами (Istio/Linkerd), непрерывной доставкой через GitOps инструменты (ArgoCD или Flux).
— Глубокие знания Terraform, OpenTofu или Pulumi для создания модульных инфраструктурных шаблонов в облаках (AWS, GCP, Azure).
— Сильные навыки программирования на Go или Python для создания расширений платформы, CLI-инструментов, Kubernetes операторов и интеграций API.
— Практический опыт создания или интеграции порталов разработчиков (Backstage, Port) и автоматизированных workflow движков.
— Опыт настройки телеметрии с Prometheus, Grafana и OpenTelemetry для метрик, логов и трассировок.
Желательно:
— Опыт с cloud-native control plane абстракциями, например Crossplane.
— Знания FinOps, мониторинга затрат контейнеров (Kubecost) и автоматической оптимизации ресурсов.
— Активное участие в open-source проектах CNCF.
— Опыт в zero-trust безопасности, управлении секретами (HashiCorp Vault) и автоматизации комплаенса.
Условия:
— Своевременные ежемесячные выплаты с гибкими опциями вывода.
— Предсказуемый график работы: 8-часовой рабочий день.
— До 24 оплачиваемых гибких дней отпуска в год для full-time позиций.
— Долгосрочные удалённые позиции в передовых компаниях.
— Персонально подобранные вакансии без типичных рекрутинговых барьеров.
— Единый процесс контрактации для множества возможностей без дополнительных оценок.
— Стабильная оплата каждый месяц при работе через Proxify.
УдалённоseniorГеография найма не уточнена, офис: Sweden
УдалённоRemote Canada
УдалённоRemote US
Bremen, Germany
УдалённоseniorГеография найма не уточнена
Renton, Washington, United States
УдалённоSt. Petersburg, Russia; Moscow, Russia; Belgrade, Serbia
seniorLisbon, Portugal; Relocation Support: full assistance for a smooth relocation for the employees and their family
Гибридsenior🌎 We welcome applications from talent worldwide and provide relocation support to Hamburg, Germany for those ready to join our team
Автоотклики